CVE-2025-2486

UEFI Shell accessible in AAVMF with Secure Boot enabled on Ubuntu

3.7 LowFix available

The Ubuntu edk2 UEFI firmware packages accidentally allowed the UEFI Shell to be accessed in Secure Boot environments, possibly allowing bypass of Secure Boot constraints. Versions 2024.05-2ubuntu0.3 and 2024.02-2ubuntu0.3 disable the Shell. Some previous versions inserted a secure-boot-based decision to continue running inside the Shell itself, which is believed to be sufficient to enforce Secure Boot restrictions. This is an additional repair on top of the incomplete fix for CVE-2023-48733.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: High
Privileges needed: None
User interaction: Active

What an attacker can affect

Confidentiality: None
Integrity: High
Availability: None

Exploit likelihood

0.14%Up 0.1 points since Nov 27, 2025

What each source reports

CVE List Score used 3.7

UEFI Shell accessible in AAVMF with Secure Boot enabled on Ubuntu

Record: CVE-2025-2486
CVSS 4.0: 3.7 LowCVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H/E:U
Weakness: CWE-489
Updated: 2026-11-02

EUVDEUVD-2025-199745 3.7

Record: EUVD-2025-199745
CVSS 4.0: 3.7 LowCVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H/E:U
Updated: 2026-11-02

GitHub AdvisoriesGHSA-g658-h443-xpr6 3.7

The Ubuntu edk2 UEFI firmware packages accidentally allowed the UEFI Shell to be accessed in...

Record: GHSA-g658-h443-xpr6
CVSS 4.0: 3.7 LowCVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 8.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-489
Updated: 2026-11-02

NVD 3.7

Record: CVE-2025-2486
CVSS 4.0: 3.7 LowCVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 8.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-489
Updated: 2026-11-02

OSV 3.7

UEFI Shell accessible in AAVMF with Secure Boot enabled on Ubuntu

Record: CVE-2025-2486
CVSS 4.0: 3.7 LowCVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H/E:U
Weakness: CWE-489
Updated: 2026-11-02

OSVDEBIAN-CVE-2025-2486 8.8

Record: DEBIAN-CVE-2025-2486
CVSS 3.1: 8.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2025-2486 3.7

Record: UBUNTU-CVE-2025-2486
CVSS 4.0: 3.7 LowCVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H/E:U
CVSS 3.1: 8.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`edk2` Debian:12	before 2022.11-6+deb12u1, plus listed versions 2022.11-6	2022.11-6+deb12u1
`edk2` Debian:13	before 2023.11-7	2023.11-7
`edk2` Debian:14	before 2023.11-7	2023.11-7
`edk2` Ubuntu:24.04:LTS	before 2024.02-2ubuntu0.3, plus listed versions 2023.05-22023.11-22023.11-32023.11-42023.11-5 Show 5 moreShow less 2023.11-62023.11-82024.02-12024.02-22024.02-2ubuntu0.1	2024.02-2ubuntu0.3

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-2486 is a low vulnerability (CVSS 3.7) in Tianocore Edk2, published November 26, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.14%, the 3rd percentile. Fixed in edk2 2022.11-6+deb12u1.